Makes health care decisions, in Montenegro

Official Gazette of Montenegro, No. 21/2023

• Do not subject individuals to decisions based solely on automated processing that have significant effects on them.
• Provide individuals with meaningful information about the logic of automated processing that affects them.

Law on Information Security, Arts. 1 to 3, 7 to 15 and 18(1) to (3) · Read the law's page

• This binds you if you access or process data, or use and manage a network and information system, in Montenegro, whether you are a business, another legal entity or a natural person, and regardless of your sector or size (Article 2).
• Adopt rules for handling data, log who has accessed it, and oversee the security of that data (Article 12).
• Physically secure the premises, spaces and devices that house your network and information system (Article 14).
• Protect the confidentiality, integrity and availability of the data you process, store or transmit through the planning, design, construction, use, maintenance and decommissioning of that system (Article 15).
• Designate an employee to monitor your compliance with these measures (Article 18(3)).

Law on Information Security, Arts. 28 to 37 · Read the law's page

• Where a cyber threat or incident has no effect on the continuity of your service, report it once a month to the Cybersecurity Agency (Article 29).
• Where a cyber threat or incident could significantly affect the continuity of your service, submit an initial notification to the Cybersecurity Agency within 24 hours of becoming aware of it, on the prescribed form (Article 30).
• For an incident the Agency rates medium, submit a first report within 72 hours of your initial notification, a further report without delay on any new development, continuing reports every 72 hours while the incident lasts, and a final report within 30 days of resolving it (Article 33).
• For an incident the Agency rates high, follow the same reporting sequence on a tighter clock: continuing reports every 24 hours while the incident lasts (Article 34).
• This binds you on the same broad terms as this jurisdiction's general security-measures row: any business, other legal entity or natural person that accesses or processes data through a network and information system in Montenegro, regardless of sector, size, or essential or important entity designation (Article 2).

Council of Europe Treaty Series No. 225 (CETS 225); Montenegro signed 5 November 2024, 11th signatory

• This measure is proposed and binds nobody yet; what follows is what it would require if it is enacted in this form.
• Provide transparency and accountability for the operation of AI systems.
• Maintain human oversight over automated decisions that have consequential effects.

No official gazette citation yet; drafting coordinated by Montenegro's Ministry of Public Administration with EuroCC Montenegro / HPC and UNDP support